Privacy Policy

Pylot Bio ("Pylot", "we", "us") provides a web-based pharmacokinetic/pharmacodynamic (PK/PD) modeling and simulation platform available at pylotbio.ai (the "Service"). This policy describes what information we collect when you use the Service, how we use it, and the choices you have.

Account and registration information. When you register, we collect your name, work email address, job title, organization name and type, and related onboarding details you provide.

Modeling and simulation data. Model configurations, parameter values, simulation results, and related workspace content you create in the Service are stored so you can access them across sessions.

AI assistant conversations. Messages you send to the in-app AI assistant, along with relevant workspace context (such as the model you are configuring or summarized simulation results), are processed to generate responses. Recent conversation history is retained temporarily to preserve context (see Section 5).

Usage and technical information. We collect standard technical data such as IP address, browser type, pages accessed, and timestamps through server logs, and we use browser storage (localStorage and session identifiers) to keep you signed in and preserve your workspace state. We do not use third-party advertising trackers.

We use the information we collect to:

• Provide, maintain, and improve the Service;
• Authenticate you and secure your account and sessions;
• Generate AI assistant responses grounded in your workspace context;
• Respond to support requests and communicate service updates;
• Monitor for abuse, enforce rate limits, and protect the Service.

We do not sell your personal information.

We use a small number of infrastructure providers to operate the Service:

• Amazon Web Services (AWS): cloud hosting, storage, and managed database services (United States).
• OpenAI: AI assistant messages and the workspace context needed to answer them are sent to OpenAI's API to generate responses. Per OpenAI's API data-usage policy, API data is not used to train OpenAI models.
• Email delivery provider: used to send account and transactional emails (e.g., invitations and password resets).

Account data and workspace content are retained while your account is active. AI assistant conversation history used for context is retained for a limited period (currently 24 hours in the conversation memory store) and then expires automatically; chat history shown in your browser is stored locally on your device and can be cleared by you at any time. Server logs are retained for operational and security purposes.

You may request deletion of your account and associated data by contacting us (Section 9).

All traffic is encrypted in transit (TLS). Access to the Service requires authentication, and production systems use access controls, session enforcement, and rate limiting. No method of transmission or storage is 100% secure, but we work to protect your information using industry-standard practices.

Depending on your jurisdiction, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To exercise these rights, contact us using the details in Section 9. If you are in the EEA/UK, you may also lodge a complaint with your local supervisory authority.

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above, and where appropriate we will notify registered users by email or in-app notice.

For privacy questions or requests, contact us via the contact page.